ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (application crash) via an unserialize call for the com, dotnet, or variant class.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade php7 | Oct 1, 2024 | Nov 20, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade php-processUpgrade php-soapUpgrade phpUpgrade php-odbcUpgrade php-gdUpgrade php-ldapUpgrade php-pdoUpgrade php-xmlrpcUpgrade php-commonUpgrade php-xmlUpgrade php-cliUpgrade php-fpmUpgrade php-recode | Jul 31, 2020 | Nov 20, 2018 |
| Php | — | Upgrade to PHP version 5.6.37Upgrade to PHP version 7.1.25 | Jan 8, 2019 | Nov 20, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub